# Feature request OAuth2
## What happened
Issue aws-samples/amazon-cognito-passwordless-auth#76 (closed, 7 comments): Would it be possible to add hooks to support OAuth2 for federated authentication from social / enterprise IdPs? I'm willing to help implement if needed, but I wanted to open this issue before doing any work on it to start a discussion to see if it's inline with the goals of this library. The idea would be to start by updating the configure method and maybe add something like ```typeScript Passwordless.configure({ //...
## What works
When you federate a Cognito user pool with social or enterprise IdPs, Cognito auto-creates a federated user on first login, which duplicates your native user. To keep one user per person: use the pre-sign-up Lambda trigger to look up an existing native user with the same email when a federated user signs up. If one exists, link the federated identity to that existing Cognito user and return undefined from the trigger so no duplicate gets created. Also keep the split straight: native users (Cognito stores the password) vs federated users (their attributes get overwritten from the IdP on every federated login), and once you federate, sign-up handling moves to the IdP.
## Caveats
This comes from one real issue thread (gh:aws-samples/amazon-cognito-passwordless-auth#76); it is the verified fix or approach from that thread, not a general manual. Check your version of Amazon Cognito first , maintainers often fix the underlying bug in a later release, and the thread may predate it.